You might try this approach. I have not tested the traffic policing, but I have confirmed that the policy-map is applied in my lab.
Create an empty class-map (e.g. CLASS_POLICE) and a policy-map (e.g. POLICY_POLICE) on the switch as per this guide.
Create a new template (e.g. NAC_Police) on the switch with the same configuration as your NAC template (e.g. DefaultWiredDot1xOpenAuth) but with the added configuration of your Policing policy (service-policy input POLICY_POLICE).
In your ISE AuthZ Profile, enable the Common Task for 'Interface Template' and specify your new template name (NAC_Police).
Upon authZ, you should see the Interface Template applied to the session:
sw1#show access-sess interf gig0/x det
Interface: GigabitEthernet0/x
<snip>
Current Policy: PMAP_DefaultWiredDot1xOpenAuth_1X_MAB
Server Policies:
<snip>
Interface Template: NAC_Police
ACS ACL: xACSACLx-IP-MM-DACL-AD-User-609cc325
You should also see the service-policy applied in the derived-config:
sw1#show derived-config int gig0/x
Building configuration...
Derived configuration : 507 bytes
!
interface GigabitEthernet0/x
<snip>
service-policy type control subscriber PMAP_DefaultWiredDot1xOpenAuth_1X_MAB
service-policy input POLICY_POLICE
end
